Identifier / Programs / Linux and Unix
ltrace
Display dynamic library calls of a process. tldr-pages
GTFOBins file-read, file-write, shell 1 ATT&CK technique 3 documented commands
How ltrace is abused
file-read
-Ffile-write
-s-o-FEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ltrace.
3 documented commands
file-read unprivileged, with sudo, as SUID
The file is parsed as a configuration file and its content is shown as error messages.
ltrace -F /path/to/input-file /dev/nullfile-write unprivileged, with sudo
The data to be written appears amid the library function call log, quoted and with special characters escaped in octal notation. The string representation will be truncated, pick a value big enough instead of 999. More generally, any binary that executes whatever library function call passing arbitrary data can be used in place of ltrace -F DATA.
ltrace -s 999 -o /path/to/input-file ltrace -F DATAshell unprivileged, with sudo
ltrace -b -L /bin/shNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ltrace. The identifier reads the line of each that runs ltrace.
What detects it
Everyday use
Print (trace) library calls of a program binary
ltrace path/to/programIdentifyCount library calls. Print a handy summary at the bottom
ltrace -c path/to/programIdentifyTrace calls to malloc and free, omit those done by libc
ltrace -e malloc+free-@libc.so* path/to/programIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.